Assuming that both your 2011 have a public IP address, the easiest to set up tunnels are GRE or IPIP:
/interface gre add remote-address=the.public.ip.of.the.remote.device
or
/interface ipip add remote-address=the.public.ip.of.the.remote.device
If you also add ipsec-secret=some-random-string-of-characters to the above command at both ends, you’ll get IPsec encryption for the tunnel with no extra effort, but as @Sebastia has warned you, in that case the throughput may be less than 100 Mbit/s as 2011 doesn’t support encryption in hardware.
The above is true if you haven’t touched any IPsec settings on either of the devices. If you did, you may have to do some manual settings to resolve possible conflict(s) between the IPsec peer and policy dynamically generated by the RouterOS for the tunnel and your existing one(s).
Once you see the tunnel interfaces up, you don’t even need to assign IP addresses to them, it is enough to use the interface names as the gateway parameters of the routes under /ip route. But be very careful with the routing, you’ll have to use so-called policy routing to make sure that connections which come to the “slow” site via its WAN interface will be also responded through it, whereas connections which come in via the tunnel will be responded through the tunnel. This requires to use /ip firewall mangle rules to assign connection-mark and later translate them to routing-mark for some packets, which in turn makes it impossible to use fasttracking for many of the connections so the 2011 may have tough time handling the traffic. Check this topic for an arrangement which allows to use policy routing and still have the major part of the traffic fasttracked, but what remains may still be too much for the 2011 to handle and you may need to replace it with something more powerful (3011, 4011 or 1100) or keep it as a switch and complement it with a hAP ac² to take care about the routing and encryption.